[論文レビュー] Automated Cyber Defence: A Review

Sanyam Vyas, John Hannay+2 more|arXiv (Cornell University)|Mar 8, 2023

Advanced Malware Detection Techniques被引用数 11

ひとこと要約

この論文は Automated Cyber Defence (ACD) を定義し、Automated blue/red agents および ACO Gyms に関する文献を調査し、実世界の展開と今後の研究を導くための要件分析を提案します。

ABSTRACT

Within recent times, cybercriminals have curated a variety of organised and resolute cyber attacks within a range of cyber systems, leading to consequential ramifications to private and governmental institutions. Current security-based automation and orchestrations focus on automating fixed purpose and hard-coded solutions, which are easily surpassed by modern-day cyber attacks. Research within Automated Cyber Defence will allow the development and enabling intelligence response by autonomously defending networked systems through sequential decision-making agents. This article comprehensively elaborates the developments within Automated Cyber Defence through a requirement analysis divided into two sub-areas, namely, automated defence and attack agents and Autonomous Cyber Operation (ACO) Gyms. The requirement analysis allows the comparison of automated agents and highlights the importance of ACO Gyms for their continual development. The requirement analysis is also used to critique ACO Gyms with an overall aim to develop them for deploying automated agents within real-world networked systems. Relevant future challenges were addressed from the overall analysis to accelerate development within the area of Automated Cyber Defence.

研究の動機と目的

• Define Automated Cyber Defence (ACD) and distinguish it from related terms.
• Develop a requirement analysis for automated blue/red agents and ACO Gyms.
• Survey and critique existing ACD publications against the requirement framework.
• Identify gaps, challenges, and future research directions in ACD.

提案手法

• Literature review following a Kitchenham-inspired methodology.
• Backward snowballing and manual search to identify ACD publications and implementations.
• Definition of ACD, automated blue/red agents, and ACO Gyms from existing sources.
• Development of a structured requirement analysis (G and A categories) for ACD components.
• Evaluation of existing works against the requirement analysis to identify gaps.
• Discussion of challenges, national strategies, and ethical considerations for deployment.

Figure 1. Research Methodology

実験結果

リサーチクエスチョン

• RQ1 RQ1: What is Automated Cyber Defence (ACD) and how is it differentiated from related terms?
• RQ2 RQ2: What algorithmic approaches are used within Automated Blue/Red Teaming and ACD?
• RQ3 RQ3: What environments or terrains (ACO Gyms) are best suited for developing and testing ACD systems?
• RQ4 RQ4: What are the key requirements and gaps hindering real-world deployment of ACD?
• RQ5 RQ5: What challenges and future directions emerge from the literature review?

主な発見

• ACD is defined as automated decision-making for cyber defense focusing on blue/red agents and ACO Gyms.
• Most automated blue-teaming works use sequential decision-making within MDPPOMDP-like formulations, but real-world generalisation and explainability remain limited.
• A substantial portion of evaluated works rely on simulated networks; few achieve real-world generalisation (A.1.3) or long-horizon planning (A.2.3).
• DRL and related sequential approaches show promise for long-term actions and generalisation, while explainability and resilience against adversarial and algorithmic attacks remain under-addressed.
• Table 3 (AICA-based requirements) and Table 4 (blue-team publications) highlight gaps in generalisability, explainability, and adversarial training; few works meet all recommended requirements (e.g., A.4.1, A.6.x).
• National strategy documents increasingly emphasize AI-enabled automated defense and the need for open, extensible ACO Gym ecosystems.